CVE-2022-1977

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks...

CVE-2022-1574

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files such as PHP on the remote server...

CVE-2022-1574

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files such as PHP on the remote server...

Cross site request forgery (csrf)

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files such as PHP on the remote server...

Elcomplus LLC SmartICS Path Traversal Vulnerability

Elcomplus LLC SmartICS is a builder of top-level visualizations for industrial automation systems from Elcomplus LLC. A path traversal vulnerability exists in Elcomplus LLC SmartICS, which stems from inadequate validation of file names. An attacker could exploit this vulnerability to perform a pa...

Design/Logic Flaw

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to...

CVE-2022-1939

The CVE-2022-1939 entry concerns the WordPress Allow svg files plugin (versions

FacturaScripts Cross-Site Scripting Vulnerability (CNVD-2022-59043)

FacturaScripts is an ERP software. A cross-site scripting vulnerability exists in versions prior to facturascripts 2022.06, which stems from a lack of filename validation, and can be exploited by an attacker to upload a svg file resulting in a cross-site scripting attack...

CVE-2022-31041 Insufficient content-type validation for uploaded files in open-forms

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users e.g. only PDF / Excel / .... The input validation of uploaded fil...

nodejs:16 security update

nodejs 1:16.14.0-4 - Apply lock file validation fixes - Resolves CVE-2021-43616 - Resolves: RHBZ2070012...

Ivanti Avalanche AgentTaskHandler Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandler class. T...

GHSA-279P-PC38-XX4P JFinal file validation vulnerability

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

JFinal file validation vulnerability

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

CVE-2022-1409

CVE-2022-1409 affects the WordPress VikBooking Hotel Booking Engine & PMS plugin prior to 1.5.8. The vulnerability arises from improper image validation in uploads, allowing high-privilege users (e.g., administrators) to upload PHP files disguised as images containing executable PHP code. This ca...

WordPress All-in-One WP Migration Plugin <= 7.58 Arbitrary File Deletion Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2022-1476

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the /lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users w...

Arbitrary file deletion

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the /lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users w...

Arbitrary File Upload

WSO2 Carbon Services is vulnerable to arbitrary file upload. The vulnerability exists because the file upload permissions and validations are not properly handled which allows an attacker to upload arbitrary files...

CVE-2022-1273

The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files such as PHP, leading to RCE...

WordPress plugin Web To Print Shop : uDraw arbitrary file reading vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Web To Print Shop: An arbitrary file reading vulnerability exists in versions of uDraw prior...